Ref: 2200h-23

November 2023

SBD Explores: Automotive SBOMs

Leveraging automotive SBOMs toenhance security and traceability
10-minute Insight
Initially, Software Bill of Materials (SBOM) were developed
outside of the automotive industry to handle software licensecompliance. The benefits of SBOM for vulnerability tracking
have since been broadly recognized and are now being
deployed as part of the effort to secure the Software-Defined
Vehicles (SDVs) of the future.
In this edition of SBD Explores, we will dive into the status ofSBOMs in the automotive industry, look at their benefits andlimitations (both inside the automotive enterprise as well as
the broader software ecosystem), and share where they needto go to keep vehicle software safe.

Target audience
Cybersecurity/ Engineering
SDV/Software

Focus market(s)GlobalWhat is happening?
What is a SBOM?
•SBOM stands for Software Bill of Materials, like a bill of materials used in manufacturing.

•SBOMs list the detailed collection of components and dependencies that make up a software package.

Role of SBOMs for OEMs•

Automakers and their partners are facing a new value chain with Software-Defined Vehicles (SDVs).
SBOMs document that value chain and enable the separation of software, from hardware configuration
management. SBOMs can be updated as new features and services are approved and deployed.

SDV Code Complexity
Services

UX

SafetyDifferentiating Software

Current Auto Cybersecurity Vulnerability Challenges
Vulnerability first publicly reported
Software builds over time

Fix released

Containing vulnerability

SecurityOTA Tools

Introduction of robust
visibility and management

Middleware

Hypervisor

Non-Differentiating
SoftwareManual workaround attempts
Bug filed for Component B
Vulnerability picked up by Component B

Ideal SBOM Supported Process

Wrapped in SBOM
Software Update & Cybersecurity
Management System (SUMS, CSMS)

SBOMs are a machine-readable format thatenable important quality tracking andverification processes.
• Modern vehicles contain software
components from OEMs, suppliers, and thirdparties. This requires strong documentation
to ensure traceability.
• Automakers can compare SBOMs withvulnerabilities. This enable the application offaster fixes or the choosing of appropriate
mitigations. Common Vulnerabilities andExposures (CVEs) can be identified, andaffected modules can be blocked from reuse.

• Across ecosystems, SBOMs can help verify
the software libraries used. Partners have
had challenges ensuring that only fixedversions are used by future components.

First fixed Component A build

OS & Drivers

Key takeaway

Component B directed to fixedversion by management systemusing SBOM tracking• Though not automotive, the Log4j/Log4Shell
software flaw in 2021-2022 was discovered
in a widely-used, open-source Javadevelopment library. Remediation challenges
taught all cyber departments the importanceof tracking and controlling versions oflibraries used in released products.
• SBOM has seen significant interest andimplementation from automotive OEMs toaddress supply chain security issues.

2Why does it matter?
Why is change needed?

Key takeaway

Complexity: With the growing number of vehicle platforms embracing the Software-Defined Vehicle(SDV), not only is a larger amount of software needed to run the vehicle, but system and code
interactions are more complex and interdependent.
Expectations: Increasingly, general purpose software and automotive-specific regulations look toSoftware Bill of Material (SBOM) documentation to ensure included software is identified and able to be
tracked against vulnerability disclosure databases.
Risk management: Over-the-air (OTA) updates can increase the chance of a cybersecurity attack due
to the vehicles being connected to the cloud. Adhering to SBOM best practices will help document thatOEMs are following their duty of care.

What are the key regulatory impacts to consider?
RegionUSAEurope

ChinaRegulator

GeneralThe White House✔

Automotive

Best Practices
Executive Order 14028 has required all software vendors to thefederal government to provide SBOMs since May 2021

While regulators currently use SBOM as a‘check item’, security goals will be gainedby thoughtful integration.
• OEM software management must fit complex
regulatory frameworks. Managing thegrowing software source code and binaries
from suppliers, consortia and in-house needs
standard formats and tools.
• Supply chain attacks show the need to verify
the authenticity of software sources. SBOM
provides efficient methods across projects
and across industries.
• Regulations and best practice guidance push
manufacturers toward good cybersecurity
practices. OEMs need to implement theprocesses to maximize the benefits, while
minimizing the cost.

National Highway
Traffic Safety
Adminsitration✔

SBOMs are included in NHTSA’s 2022 “Cybersecurity BestPractices for the Safety of Modern Vehicles”

United Nations
EconomicCommission forEurope• SBOMs help quickly propagate implemented
fixes, if the SBOM system is embedded indevelopment and update processes.

✔

UNECE Regulation 156 requires manufacturers to implement asoftware update management system to document safety of thevehicle and its occupants, including version tracking• Rather than a tool to assign blame between
OEMs and suppliers, SBOMs should speed up
fixes, and prevent known vulnerabilities frombeing distributed.

EuropeanCommission✔

MIIT(中国工业和信息化部)✔

The “Cyber Resilience Act” requires the use of SBOM by vendors
and producers of software✔

The Ministry of Industry and Information Technology of China
published a guide for security risk management in the connected
car supply chain - other activity is ongoing3

Where Next?
Key takeaway

1Insourcing
software toOEMs withSBOMs

Experimentswith crosscompany
SBOMs

2

FutureOutlookGlobalizationof R156
compliance3

Shared SBOM
standards

4Now

1-5yrs5yrs+

As OEMs build more software in-house fornext generation Software-Defined
Vehicles, internal SBOMs can be better
tracked to ensure known vulnerabilities are
fixed before release.
OEMs are experimenting with the use of
SBOMs with trusted partners. This is toprovide increased traceability from first
vulnerability news to accelerated repair ofaffected systems, and services, acrosstheir supply chain.

SBOMs meet the requirements of R156
and improve robustness of over-the-airupdates.

In the long term, consumers will benefit
from quicker updates and less recalls viaOEM SBOM standardization for common
middleware to better secure the vehicle
ecosystem.

OEMs can use the Software-Defined Vehicletransformation to more clearly identify andefficiently protect the value creation ofautomotive software.
• As OEMs increase their participation in thesoftware value of automobiles, they are
gaining deeper understanding of softwaresystem dependencies within and outside theorganization. This understanding includes
tracking licenses, original authors, andcurrent maintainers of software packages.
• In the near term, SBOM generation byscanning existing code will highlight areas ofconcern to system module integrators. As
software authors add SBOM to theirdevelopment flows, increased visibility to therelative risks of dependency options will
improve system robustness.
• Automotive processes are increasingly reliant
on SBOMs as documentation thatcybersecurity verifications were completed.
As R156 expands to more models andregions, simplifying reuse within a company
will gain in importance.
• Suppliers will gain efficiencies if SBOM
documentation can scale across multiple
systems and OEMs.
4

Who to watch out for?
Standards bodies, industry consortiums and commercial test houses & toolproviders are laying the groundwork for SBOM adoption•Standards Bodies & Regulators: SBOM benefits from greater standardization specifying SBOM formats(ISO/IEC 5926) and in SBOMs being accepted by certification bodies to meet other standards andregulations (SAE/ISO 21434, UNECE 156).

•Industry Consortiums: How SBOMs can be best applied to specific automotive environments is being
deliberated and tested as OEMs implement them into larger processes and frameworks.

•Test Houses & Tool Providers: SBOMs allow a common language for communication of softwarecontents, enabling new tool integrations, verification processes and source monitoring.

Key takeaway
Certification bodies and standards
organizations are partnering with theautomotive industry to achieve increasinglevels of cybersecurity via collaboration.

• OEMs need to improve SBOM processes tomeet the requirements of future typeapproval regulations.
• Certification bodies expect the continuous
improvements needed to meet everincreasing cybersecurity challenges. It is a
mistake to think that the same methods
used for approvals today will be enough forthe future.

Automotive Cybersecurity• Auto-ISAC and GlobalPlatform are two
examples of organizations with automotive
SBOM working groups.
Software & Tools

General Processes• Generic SBOM formats, protocols, andstandards continue to be refined based on
industry feedback and changing
technologies.
• Further requirements and recommendations,depending on robust SBOM implementations,are expected.

General Cybersecurity
Standards Bodies & Regulators

Industry Consortiums

Test Houses & Tool Providers

5How should you react?

1
2
3Embrace
Embrace SBOM deployment anddevelopment by enabling companywide and ecosystem softwaremodule version and control.

Implement
Leverage SBOMs to ‘shift left’ to takeadvantage of improved traceability
resulting in fewer vulnerabilities andfaster patching.

Collaborate
Identify industry consortiums andtool supplier partners to optimize
deployment of existing SBOM
solutions and processes forautomotive applications.

Authors

Jeffery Hannah

Andrew Wilczynski

Chief Commercial Officer

Research Analyst

Related SBD Reports
Ref: 404
Securing The
SoftwareDefined
VehicleRef: 905
CyberIntelligence
Guide

Related SBD Consultancy▪ Automotive Cybersecurity Advisory ▪ UNECE R155/R156 Compliance▪ Threat Assessment and▪ Penetration Testing
Remediation Analysis (TARA)Interested in finding out more?
If you would like to discuss recent cybersecurity projects that we havecompleted, and how to secure the Software Defined Vehicle, pleasecontact us.

6